Hardcoded credentials

ghinstallation provides transport, which implements http.RoundTripper to provide authentication as an installation for GitHub Apps. In ghinstallation version 1, when the request to refresh an installation token failed, the HTTP request and response would be returned for debugging. The request...

CVE-2022-39304 ghinstallation returns app JWT in error responses

ghinstallation provides transport, which implements http.RoundTripper to provide authentication as an installation for GitHub Apps. In ghinstallation version 1, when the request to refresh an installation token failed, the HTTP request and response would be returned for debugging. The request...

CVE-2022-39304

CVE-2022-39304 concerns ghinstallation, which provides a transport for GitHub Apps authentication. In ghinstallation version 1, if refreshing an installation token failed, the HTTP request and response were returned for debugging, revealing the App’s bearer JWT (short-lived, up to 10 minutes) to ...

CVE-2022-39304 ghinstallation returns app JWT in error responses

ghinstallation provides transport, which implements http.RoundTripper to provide authentication as an installation for GitHub Apps. In ghinstallation version 1, when the request to refresh an installation token failed, the HTTP request and response would be returned for debugging. The request...

GHSA-H4Q8-96P6-JCGR ghinstallation returns app JWT in error responses

Impact In ghinstallation v1, when the request to refresh an installation token failed, the HTTP request and response would be returned for debugging. https://github.com/bradleyfalzon/ghinstallation/blob/24e56b3fb7669f209134a01eff731d7e2ef72a5c/transport.goL172-L174 The request contained the beare...

CVE-2022-47549

An unprotected memory-access operation in opteeos in TrustedFirmware Open Portable Trusted Execution Environment OP-TEE before 3.20 allows a physically proximate adversary to bypass signature verification and install malicious trusted applications via electromagnetic fault injections...

CVE-2022-20531

In Telecom, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

The vulnerability of the Microsoft Office Graphics component in the Microsoft 365 Apps for Enterprise suite allows a perpetrator to execute arbitrary code.

The vulnerability of the Microsoft Office Graphics component in the Microsoft 365 Apps for Enterprise suite is related to insufficient input validation. Exploiting this vulnerability could allow an attacker to execute arbitrary code by sending specially crafted data...

Trend Micro Joins Google’s App Defense Alliance

Trend Micro will be joining Google's App Defense Alliance ADA to help improve their ability to identify malicious apps before they are published to the Google Play store...

The vulnerability of the Microsoft Office Graphics component in the Microsoft 365 Apps for Enterprise suite allows a perpetrator to execute arbitrary code.

The vulnerability of the Microsoft Office Graphics component in the Microsoft 365 Apps for Enterprise suite is related to the use of memory after it is released. Exploiting this vulnerability could allow an attacker to execute arbitrary code using a specially created SKP file...

The vulnerability of the Microsoft Office Graphics component in the Microsoft 365 Apps for Enterprise suite allows a perpetrator to execute arbitrary code.

The vulnerability of the Microsoft Office Graphics component in the Microsoft 365 Apps for Enterprise suite is related to insufficient input validation. Exploiting this vulnerability could allow an attacker to execute arbitrary code using a specially created file...

Microsoft Security Update Validation Report December 2022

Microsoft’s December 2022 security updates have passed Citrix testing the updates are listed below. The testing is not all-inclusive; all tests are executed against English only environments and issues may still be found upon implementation. Follow best practices for testing and installing softwa...

The vulnerability of the Microsoft Office Graphics components in Microsoft Office programs and Microsoft 365 Apps for Enterprise allows a perpetrator to execute arbitrary code.

The vulnerability of the Microsoft Office Graphics packages and Microsoft 365 Apps for Enterprise is related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to execute arbitrary code using a specially created file...

The vulnerability of the Microsoft Office Graphics component in the Microsoft 365 Apps for Enterprise suite allows a perpetrator to execute arbitrary code.

The vulnerability of the Microsoft Office Graphics component in the Microsoft 365 Apps for Enterprise suite is related to insufficient input validation. Exploiting this vulnerability could allow an attacker to execute arbitrary code using a specially created file...

The vulnerability of the Microsoft Office Graphics component in the Microsoft 365 Apps for Enterprise suite allows a perpetrator to execute arbitrary code.

The vulnerability of the Microsoft Office Graphics component in the Microsoft 365 Apps for Enterprise suite is related to insufficient input validation. Exploiting this vulnerability could allow an attacker to execute arbitrary code using a specially created file...

CVE-2022-32945

An access issue was addressed with additional sandbox restrictions on third-party apps. This issue is fixed in macOS Ventura 13. An app may be able to record audio with paired AirPods...

CVE-2022-32945

An access issue was addressed with additional sandbox restrictions on third-party apps. This issue is fixed in macOS Ventura 13. An app may be able to record audio with paired AirPods...

Design/Logic Flaw

An access issue was addressed with additional sandbox restrictions on third-party apps. This issue is fixed in macOS Ventura 13. An app may be able to record audio with paired AirPods...

Android Malware Campaign Leverages Money-Lending Apps to Blackmail Victims

A previously undocumented Android malware campaign has been observed leveraging money-lending apps to blackmail victims into paying up with personal information stolen from their devices. Mobile security company Zimperium dubbed the activity MoneyMonger, pointing out the use of the cross-platform...

CVE-2022-32945

CVE-2022-32945 affects macOS, with Apple noting an access issue that could allow an app to record audio via paired AirPods. The root cause is tied to sandbox restrictions on third‑party apps; Apple states the vulnerability is fixed in macOS Ventura 13. The CVE appears in multiple Apple advisories...